1.4.0 / 2018-02-13

• Fix resolving paths with certain special characters
• deps: http-errors@~1.6.2
  • Make message property enumerable for HttpErrors
  • deps: depd@1.1.1
  • deps: setprototypeof@1.0.3

1.3.3 / 2016-11-14

• deps: path-is-absolute@1.0.1

1.3.2 / 2016-06-17

• deps: http-errors@~1.5.0
  • Use setprototypeof module to replace __proto__ setting
  • deps: inherits@2.0.1
  • deps: statuses@'= 1.3.0 < 2'
  • perf: enable strict mode

1.3.1 / 2016-02-28

• deps: http-errors@~1.4.0

1.3.0 / 2015-06-15

• Use path-is-absolute to better detect absolute paths
• perf: enable strict mode
• perf: skip a variable reassignment

1.2.2 / 2015-02-16

• deps: http-errors@~1.3.1
  • Construct errors using defined constructors from createError
  • Fix error names that are not identifiers
  • Set a meaningful name property on constructed errors

1.2.1 / 2015-01-19

• Fix root path disclosure

1.2.0 / 2015-01-05

• Change error to 403 Forbidden when outside root
• Fix argument type errors to be consistent
• Fix path traversal vulnerability
• Use http-errors module directly

1.1.0 / 2014-12-27

• Resolve the root path argument
• Use http-assert module

1.0.0 / 2014-03-23

• Initial release